Artificial intelligence (AI) is changing the economics of cyber crime, lowering the technical barrier to sophisticated attacks while creating new security and governance challenges for companies.
This was a central message from speakers at TrendAI’s Spark 2026 event in Sun City last week, where security executives warned that businesses cannot afford to treat AI governance and security as an afterthought.
Emmanuel Tzingakis, technical manager for Africa and venture markets at cyber security firm TrendAI, said one of the biggest changes brought by AI is that attackers no longer require the same level of technical expertise to launch sophisticated attacks.
“It's no longer about skill. It's about how much imagination you have,” he said.
He contrasted the current environment with the early days of hacking, when sophisticated attacks depended heavily on coding skills and specialist expertise.
Tzingakis said AI is already being used across the cyber crime ecosystem, rather than being a threat that companies must prepare for at some point in the future.
“AI is not going away,” he said.
The technology can assist with research, generate more convincing social engineering campaigns and analyse information obtained from compromised environments, he added.
Tzingakis said attackers can use AI to examine publicly available information about individuals and companies and combine it to create a more detailed picture of potential targets.
The result is a lower barrier to sophisticated cyber crime. “Anybody can become a hacker these days,” he said.
AI expands the attack surface
While attackers are adopting AI, companies are simultaneously introducing the technology into their own environments.
Bilal Baig, VP of solution engineering at TrendAI, said AI is changing the way software is developed and creating a new security challenge because companies are dealing with an increasingly complex technology environment.
The attack surface is no longer limited to the traditional technologies security teams have historically protected, he added.
AI introduces additional considerations, including AI applications, models and autonomous systems.
Baig's presentation focused on the changing security architecture required as companies move into an environment where AI can increasingly be part of business processes.
The speed of AI adoption is also creating visibility challenges.
Companies may not always know which AI technologies are being used, what data is being processed or how those technologies are operating within their environments. This creates a governance gap, particularly when AI applications are introduced outside established technology processes.
The challenge becomes more significant as companies begin working with AI agents and autonomous systems.
Baig argued that security must evolve alongside this shift rather than treating AI as simply another application to be secured.
Governance must keep pace with AI adoption
Grant Hughes, CISO at The Nascent Group, highlighted visibility as the starting point for effective AI governance. He said companies must know where AI is being used before they can establish appropriate controls.
“If we don't have visibility, there's no way that we can apply the policy,” Hughes said.
He questioned whether security and technology leaders could confidently identify all the AI applications being used within their companies.
“Where are we using AI right now? And what are we going to build up?” he asked.
Hughes said companies often discover that different parts of the business are already using AI applications that were not captured through formal processes.
The problem is not necessarily limited to employees deliberately ignoring corporate rules. AI tools can be adopted organically because they solve an immediate business problem or make an employee more productive.
Hughes said governance must therefore reflect how people actually work, rather than becoming a set of rules that employees are likely to circumvent.
Too much governance can be counterproductive, he warned, but too little leaves companies exposed.
He said companies should establish a framework that allows employees to use AI safely, defining which applications and use cases are approved and what process to follow when a new use case falls outside existing policy.
Governance must keep moving
Hughes stressed that AI governance cannot be treated as a once-off exercise, comparing it with security monitoring, where controls must continue operating effectively after they have initially been put in place.
He said ownership is another important part of the governance process, with responsibility needing to be connected to the business processes in which technology is being used, rather than policies existing only within security or technology departments.
The challenge of speed
Assad Arabi, regional MD for Africa, Türkiye, CIS and venture markets at TrendAI, focused on the growing speed of AI-enabled attacks and the implications for traditional security operations.
He said companies have historically built security architectures around assumptions about how threats develop and how much time defenders have to respond. AI, he said, is challenging those assumptions by accelerating the activities attackers can perform, leaving defenders with almost no time to take action.
He argued that simply adding more security tools and generating more data is not necessarily the answer
, and that companies should instead focus on the quality of their data and processes.
This is particularly important as companies increasingly use AI to support security decisions, he said, noting that AI model quality depends on data quality. Poor-quality information can therefore undermine the effectiveness of an AI-driven security system, regardless of the sophistication of the underlying technology.
From reactive to proactive security
Arabi said the speed of AI-enabled threats requires security teams to move towards a more proactive approach.
Rather than relying solely on detecting and responding to incidents after they occur, he argued that security operations should increasingly predict potential threats and prevent their effects.
He said security operations are moving from a detect-and-respond model to one focused on predicting and preventing threats, while still being able to address critical incidents when they occur.
AI can help security teams bring together information from different sources, identify patterns and provide greater context around potential threats.
He described a future in which security professionals have a broader view of their environments and can use AI to help determine where risks are emerging and what actions may be required.
However, the increasing use of autonomous systems also creates a requirement for stronger security foundations.
Arabi said companies need visibility into the AI systems operating within their environments, and security architectures capable of dealing with the speed at which those systems and threats are evolving.
Share
